SSL (Secure Sockets Layer) and/or TLS (Transport Layer Security)

learn more… | top users | synonyms (2)

-1
votes
0answers
11 views

How safe is Chase & Bank of America Android Mobile App

Pretty straight forward question, how safe are chase and Bank of America android mobile app. Safe in the sense that your following every procedure to safe guard yourself and your phone, that being: ...
-1
votes
1answer
7 views

Question regarding Oauth and https

Whats the difference between Oauth protocol and https protocol?
1
vote
6answers
3k views

How can I know that the CA certificates in my computer have not been spoofed?

As far as I know, the browser contains the certificates of several CA. When I access http://gmail.com, the site says it is Gmail, it exposes a certificate signed by one of the CA I have in my ...
1
vote
2answers
27 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
0
votes
0answers
14 views

IIS 8.5 TLS 1.2 not working [migrated]

I have Windows 8.1 with IIS 8.5 and have run the script from http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12 to enable TLS 1.2, but Qualys SSLLabs says my server ...
1
vote
0answers
21 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
3
votes
4answers
2k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
0
votes
2answers
113 views

What would cause a server to only send over 1 SSL certificate to a client?

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
0answers
19 views

some Concerns about security in online merchants sites

I want clarification regarding some concerns about online merchants : is there some standard classification for online merchants ? how can you recognize if the site is real or fake ? through using ...
165
votes
4answers
35k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
3
votes
1answer
48 views

Is it any more secure to use a HTML form instead of a javascript popup?

Assuming both use session authentication, token validation and forced https: Is there any difference in security between submitting data via a JS popup <> ajax endpoint, and a standard web page ...
1
vote
2answers
161 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
0
votes
2answers
69 views

Why do browsers probe and fallback (or, why SSL_MODE_SEND_FALLBACK_SCSV)?

I've been following POODLE and the SSL_MODE_SEND_FALLBACK_SCSV TLS extension. I never really paid much attention to it, but it appears SSL_MODE_SEND_FALLBACK_SCSV is needed for clients like browsers ...
-4
votes
1answer
132 views

If NSA can't decrypt TLS why don't we use it to encrypt phone calls [on hold]

If an individual can convert his voice into Internet traffic using a simple combination of hardware and software what stop governments from using it and avoid NSA spying on them? To clarify: Since ...
0
votes
1answer
312 views

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

My title pretty much sums it up. If I have: A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled. Would that mean that a protocol downgrade attack can still occur?
1
vote
2answers
190 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
2
votes
1answer
113 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
3
votes
2answers
68 views

Could SSL-like encryption be used for not password-protected wireless access points?

I'm looking at ways an outsider (i.e. someone without a possible password) of the network could sniff the communication within the network, specifically focusing on WLAN. This is what I understand ...
1
vote
2answers
301 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
5
votes
2answers
323 views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
1
vote
1answer
112 views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
14
votes
3answers
988 views

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit ?
0
votes
2answers
34 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
2answers
62 views

Is 'correct' TLS Configuration dependant mainly on the Server?

Here is a link to a screen grab of SSL Configuration Checker by GlobalSign for my domain: SSL Configuration Checker: http://i.imgur.com/CbVjVee.png. Following recent discussions with the host, they ...
11
votes
3answers
2k views

Why doesn't the TLS protocol work without the SSLv3 ciphersuites?

While disabling SSLv3 from our ssl.conf files to overcome the Poodle vulnerability, I also disabled the SSLv3 ciphers using !SSLv3. With the ciphers disabled, we were not able to access the website ...
1
vote
1answer
63 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
97
votes
3answers
67k views

What's the difference between SSL, TLS, and HTTPS?

I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
11
votes
2answers
4k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
-1
votes
1answer
24 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
-1
votes
1answer
20 views

Does DH parameter file need to be unique per private key?

There is scant information available online on the DH parameters used in DHE ciphers (and the kind that's available is aimed at cryptographers, not systems administrators). Basically, as a sysadmin, I ...
3
votes
0answers
201 views

POODLE: Disabling SSLv3 in Apache [migrated]

Everybody seems to be talking about the POODLE vulnerability today. And everybody recommends disabling SSLv3 in Apache using the following configuration directive: SSLProtocol All -SSLv2 -SSLv3 ...
1
vote
1answer
40 views

Can Cipher Suites defined in TLSv1.2 be negotiated by clients that only support TLSv1.0?

If my server has only the cipher suites enabled which are defined by TLSv1.2 does that force a client to also use TLSv1.2 or else not be able to connect or can the connection fallback to TLSv1.1 or ...
13
votes
2answers
4k views

How do I use “openssl s_client” to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?
0
votes
3answers
785 views

Any alternative available for RSA? Is the web still visible to NSA?

After the Snowden revelations, is there any mass change being carried out to HTTPS protocol? As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA ...
2
votes
2answers
369 views

Disable SSLv3 system-wide for all clients?

After reading about Poodle secutrity bug, I have disabled SSLv3 on my servers and browsers. But there are several clients that do not expose settings detailed enough via their own means of ...
2
votes
0answers
72 views

Does Firefox support TLS on non-standard ports? [migrated]

My presumption was that TLS 1.0+ is supported by Firefox on ports other than 443. However, a tweet crossed my path that seems to debunk this. Turns out that Firefox does not support TLS on any ...
375
votes
3answers
157k views

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...
0
votes
0answers
33 views

What's the impact of POODLE to the Internet? [duplicate]

POODLE can be exploited on SSL 3.0 and TLS 1.0, as the latter falls back to SSL 3 after multiple connection errors. I wonder how many use these protocols for encrypted data transfer, will it be a ...
0
votes
1answer
39 views

Creating secure communication line for mobile payment

Is SSL the most efficient way for creating a encrypted communication between the user's mobile to the backend server? I understand that there is a flaw in SSL, so I was wondering is there other ...
10
votes
4answers
645 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
1
vote
1answer
107 views

Android support for TLS 1.1

Do anybody know from what version of Android did TLS 1.1 started to be supported directly by the OpenSSL version preinstalled in the system?
3
votes
2answers
98 views

What role do hashes play in TLS/SSL certificate validation?

After coming across this question in the Hot Network Questions section and reading the related blog post by Google, I'm starting to become curious as to what role these hash functions play in TLS/SSL ...
1
vote
2answers
64 views

Why would Comodo SSL certs have two intermediate CAs (chain length 4)?

Comodo certs such as PositiveSSL have a chain length of 4, including two intermediate CA certs. What would be the benefit to them, or to me, of this length chain instead of a chain length of 3 with a ...
4
votes
0answers
21 views

What information do EAP-TLS certificates contain?

I recently read a couple of topics on stackoverflow, concerning the verification of Wi-Fi access points: How Are Wi-Fi access points verified? Why is a CA certificate required for EAP-TLS clients? ...
4
votes
3answers
111 views

SSL Certificate - is passphrase necessary and how does apache know it?

I want to generate a Certificate Signing Request for my server and in order to do so, I first need a secure private key. When I create a private key by using openssl genrsa -des3 -out server.key 2048, ...
0
votes
1answer
45 views

How to get SSL certificate of a mail server?

I need to get SSL certificate of some mail servers. I know I need to do execute following steps. Do a DNS mx query on the domain name (dig google.com mx). Use the information to download SSL ...
4
votes
2answers
374 views

Privacy of Image search with https

I am connected to the internet in the office where I don't want the administrator of the network to find out the contents I check (for example images). First I use a Firefox private browsing window ...
1
vote
2answers
112 views

SSL ciphers for nginx to support CloudFlare and CloudFront

Could someone suggest an optimal ssl cipher configuration for my nginx server that supports both CloudFlare and CloudFront? I have tried a few of the suggestions in other threads, but CloudFront ...
5
votes
0answers
84 views

When does iOS check validity of enterprise certificates?

This article should give a little more context (and see my comment on it, same username, for additional info): http://www.engadget.com/2014/10/08/ios-update-will-block-emulators/ iOS developers are ...
0
votes
2answers
71 views

PKI certificate validation graphs, trees and cross signing

I am just trying to get the basics of PKI and TLS and understand how it works. I came across Mozillas post about pkix where they mention that the new library allows graph processing and hence it ...